Coraza - Web Application Firewall input validation error vulnerability

Coraza – Versions prior to 3.8.1 contain an input validation error vulnerability. This occurs because when using Go’s mime.ParseMediaType to extract filenames from multipart uploads, the RFC 5987 filename parameter is silently ignored if its character set is not utf-8 or us-ascii. Unauthenticated...

GO-2026-6691 Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza

Coraza: Multipart filename RFC 5987 charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza...

PT-2026-118013

Coraza: Multipart filename RFC 5987 charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza...